You manage multiple internal-only applications that are hosted within different Google Cloud projects. You are deploying a new application that requires external internet access. To maintain…

Question

Options

• ADeploy the application within the same project as an internal application. Use a Shared VPC
• BPlace the application in the same project as an existing internal application, and adjust firewall
• CCreate a VPC Service Controls perimeter, and place the new application's project within that
• DCreate a new project for the application, and use VPC Network Peering to access necessary

• A
  3% (1)
• B
  8% (3)
• C
  5% (2)
• D
  85% (33)

Explanation

The strongest security isolation between an externally-facing application and internal systems is achieved by placing them in separate projects. Google Cloud projects provide strong security boundaries with independent IAM policies, API enablement, billing, and network configurations. VPC Network Peering can then be used to provide controlled, explicit access to specific internal services as needed, rather than broad exposure. Options A and B place the external application in the same project as internal systems, which undermines isolation - a compromise of the external app could more easily affect internal resources. Option C (VPC Service Controls perimeter) is designed to protect Google-managed APIs from data exfiltration, not to isolate an externally-facing application from internal systems at the network and IAM boundary level.

No community discussion yet for this question.